You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by mi...@apache.org on 2015/12/15 20:45:29 UTC
hbase git commit: HBASE-13425 Documentation nit in REST Gateway
impersonation section
Repository: hbase
Updated Branches:
refs/heads/master 64c55b489 -> f0a97a1fd
HBASE-13425 Documentation nit in REST Gateway impersonation section
Project: http://git-wip-us.apache.org/repos/asf/hbase/repo
Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/f0a97a1f
Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/f0a97a1f
Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/f0a97a1f
Branch: refs/heads/master
Commit: f0a97a1fdf0d8386f089306fdc1089080758e973
Parents: 64c55b4
Author: Misty Stanley-Jones <ms...@cloudera.com>
Authored: Mon Aug 10 09:54:42 2015 +1000
Committer: Misty Stanley-Jones <ms...@cloudera.com>
Committed: Tue Dec 15 11:45:21 2015 -0800
----------------------------------------------------------------------
src/main/asciidoc/_chapters/security.adoc | 32 +++++++++++++++-----------
1 file changed, 19 insertions(+), 13 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hbase/blob/f0a97a1f/src/main/asciidoc/_chapters/security.adoc
----------------------------------------------------------------------
diff --git a/src/main/asciidoc/_chapters/security.adoc b/src/main/asciidoc/_chapters/security.adoc
index d63b701..c346435 100644
--- a/src/main/asciidoc/_chapters/security.adoc
+++ b/src/main/asciidoc/_chapters/security.adoc
@@ -236,39 +236,41 @@ To enable it, do the following.
<<security.gateway.thrift>> describes how to configure the Thrift gateway to authenticate to HBase on the client's behalf, and to access HBase using a proxy user. The limitation of this approach is that after the client is initialized with a particular set of credentials, it cannot change these credentials during the session. The `doAs` feature provides a flexible way to impersonate multiple principals using the same client. This feature was implemented in link:https://issues.apache.org/jira/browse/HBASE-12640[HBASE-12640] for Thrift 1, but is currently not available for Thrift 2.
-*To allow proxy users*, add the following to the _hbase-site.xml_ file for every HBase node:
+*To enable the `doAs` feature*, add the following to the _hbase-site.xml_ file for every Thrift gateway:
[source,xml]
----
<property>
- <name>hadoop.security.authorization</name>
+ <name>hbase.regionserver.thrift.http</name>
<value>true</value>
</property>
<property>
- <name>hadoop.proxyuser.$USER.groups</name>
- <value>$GROUPS</value>
-</property>
-<property>
- <name>hadoop.proxyuser.$USER.hosts</name>
- <value>$GROUPS</value>
+ <name>hbase.thrift.support.proxyuser</name>
+ <value>true/value>
</property>
----
-*To enable the `doAs` feature*, add the following to the _hbase-site.xml_ file for every Thrift gateway:
+*To allow proxy users* when using `doAs` impersonation, add the following to the _hbase-site.xml_ file for every HBase node:
[source,xml]
----
<property>
- <name>hbase.regionserver.thrift.http</name>
+ <name>hadoop.security.authorization</name>
<value>true</value>
</property>
<property>
- <name>hbase.thrift.support.proxyuser</name>
- <value>true/value>
+ <name>hadoop.proxyuser.$USER.groups</name>
+ <value>$GROUPS</value>
+</property>
+<property>
+ <name>hadoop.proxyuser.$USER.hosts</name>
+ <value>$GROUPS</value>
</property>
----
-Take a look at the link:https://github.com/apache/hbase/blob/master/hbase-examples/src/main/java/org/apache/hadoop/hbase/thrift/HttpDoAsClient.java[demo client] to get an overall idea of how to use this feature in your client.
+Take a look at the
+link:https://github.com/apache/hbase/blob/master/hbase-examples/src/main/java/org/apache/hadoop/hbase/thrift/HttpDoAsClient.java[demo client]
+to get an overall idea of how to use this feature in your client.
=== Client-side Configuration for Secure Operation - REST Gateway
@@ -306,6 +308,10 @@ To enable REST gateway Kerberos authentication for client access, add the follow
[source,xml]
----
<property>
+ <name>hbase.rest.support.proxyuser</name>
+ <value>true</value>
+</property>
+<property>
<name>hbase.rest.authentication.type</name>
<value>kerberos</value>
</property>